In plain English. This Addendum governs Pazau's AI Features: Pazau Agent, Voice AI, Insights scoring, and drafting and summarization tools. Pazau does not train or fine-tune foundation models on your data, and neither do our model providers. Model providers operate under zero data retention terms. You own your Outputs. You decide what the AI is allowed to do through Procedures, Actions, and approval thresholds, and you are responsible for those choices. Every AI decision is recorded in a Trace you can export. We give you 30 days' notice before a material model change. We don't allow the AI Features to be used for practices the EU AI Act prohibits, and we help you tell your customers when they are talking to an AI.
This AI Addendum ("AI Addendum") forms part of the Subscription Agreement (the "Agreement") between the Pazau entity identified on the Order Form ("Pazau") and the customer identified on the Order Form ("Customer"). It applies whenever Customer or its Authorized Users use the AI Features. Capitalized terms not defined in this AI Addendum have the meanings given in the Agreement or the Data Processing Addendum ("DPA").
1. Definitions
1.1 "AI Features" means the features of the Services that use machine learning or generative models to produce Outputs or take Actions, including Pazau Agent, the AI capabilities of Pazau Voice (including AI voice agents, live agent assist, and real-time transcription), Pazau Insights conversation scoring and topic analysis, and drafting, summarization, translation, and classification tools within Pazau Inbox.
1.2 "Approval Step" means a configurable control within a Procedure that requires an Authorized User to review and approve a proposed Action or Output before it is executed or sent. An "approval threshold" is a Customer-configured condition (for example, a refund amount, a customer tier, or a confidence score) that triggers an Approval Step.
1.3 "Customer Model Improvement" means the optional, opt-in program described in Section 4.
1.4 "Foundation Model" means a general-purpose machine learning model, including a large language model, speech-to-text model, or text-to-speech model, that is trained on broad data and is capable of performing a wide range of tasks, whether developed by Pazau or a Model Provider.
1.5 "Inputs" means Customer Data submitted to or processed by the AI Features, including conversation content, Procedures, knowledge base content, and data retrieved through Actions.
1.6 "Model Provider" means a third party that hosts or provides a Foundation Model used to deliver the AI Features. Model Providers are Sub-processors and are listed on the Sub-processors page.
1.7 "Outputs" means content, classifications, scores, summaries, transcriptions, and proposed or executed Actions generated by the AI Features in response to Inputs.
1.8 "Prohibited AI Use" means any use described in Section 8.
1.9 "Traces" means the records Pazau generates of the operation of the AI Features, including the Procedure invoked, retrieved context, reasoning steps, tool calls and Action parameters, Approval Step decisions, guardrail events, and resulting Outputs.
2. Scope and order of precedence
2.1 This AI Addendum supplements the Agreement. For the AI Features, if this AI Addendum conflicts with the Agreement, this AI Addendum prevails, except that (a) the DPA prevails with respect to the processing of Personal Data, and (b) any Business Associate Agreement prevails with respect to Protected Health Information.
2.2 Outputs and Traces are Customer Data. All protections the Agreement, the DPA, and the Security Addendum give to Customer Data apply to them.
2.3 Nothing in this AI Addendum expands Pazau's liability beyond Section 15 (Limitation of liability) of the Agreement.
3. No training on Customer Data
3.1 No Foundation Model training. Pazau will not use Customer Data, including Inputs, Outputs, and Traces, to train, retrain, fine-tune, or otherwise improve any Foundation Model, whether owned by Pazau or a Model Provider.
3.2 Model Provider commitments. Pazau will maintain written agreements with each Model Provider that (a) prohibit the Model Provider from using Customer Data to train or improve any model; (b) require zero data retention, meaning Inputs and Outputs are processed transiently to generate a response and are not stored by the Model Provider after the response is returned, including for abuse monitoring; (c) prohibit human review of Customer Data by Model Provider personnel; and (d) impose confidentiality and security obligations no less protective than those in the DPA.
3.3 Service analytics. Pazau may collect and use Usage Data (for example, latency, token counts, error rates, resolution rates, and feature adoption) to operate, secure, and improve the Services, provided that Usage Data does not include the content of Customer Data and is not used for Foundation Model training. Pazau may publish aggregated statistics derived from Usage Data only if they do not identify Customer, any End User, or any individual.
3.4 Pazau-owned components. Pazau may train and improve its own non-Foundation Model components (for example, routing heuristics and guardrail classifiers) only on data that is not Customer Data, such as synthetic data, licensed datasets, and public data.
4. Customer Model Improvement (opt-in)
4.1 Off by default. Customer Model Improvement is disabled unless Customer enables it through an administrator setting in the Services or agrees to it in an Order Form. An Authorized User without administrator permissions cannot enable it.
4.2 What it does. When enabled, Pazau may use Customer Data to create customer-specific artifacts that improve the AI Features for Customer only. These artifacts are limited to retrieval indices, evaluation sets, few-shot example libraries, intent and topic classifiers, and lightweight adapters layered on a Foundation Model ("Customer Artifacts").
4.3 Isolation. Customer Artifacts are logically isolated to Customer's tenant, are used only to provide the Services to Customer, and are never used for any other customer or to train a Foundation Model. Customer Artifacts are Customer Data.
4.4 Opt-out and deletion. Customer may disable Customer Model Improvement at any time. Pazau will stop creating Customer Artifacts immediately and delete existing Customer Artifacts within 30 days of opt-out. On termination of the Agreement, Customer Artifacts are deleted in accordance with the DPA.
5. Ownership of Outputs
5.1 As between the parties, Customer owns all Outputs. To the extent Pazau has any rights in Outputs, Pazau assigns them to Customer. Pazau's rights in Outputs are limited to the license Customer grants in the Agreement to provide the Services.
5.2 Customer acknowledges that, because of the nature of generative models, the AI Features may produce similar or identical Outputs for other customers. Outputs generated for another customer are not Customer's Outputs.
5.3 Pazau retains all rights in the Services, the AI Features, Pazau's prompts and system instructions, and any Pazau model or component. Nothing in this AI Addendum transfers ownership of any Foundation Model to Customer.
6. Human oversight and Customer configuration
6.1 Customer controls the agent. Customer determines, through its configuration of the Services, what the AI Features are permitted to do. This includes (a) the content of Procedures; (b) which Actions are enabled, the systems they connect to, and the credentials and scopes they use; (c) approval thresholds and Approval Steps; (d) handoff rules to human agents; (e) channels, languages, and hours in which the AI Features operate; and (f) guardrail and redaction settings in Pazau Guard.
6.2 Responsibility for configuration. Customer is responsible for its configuration and for testing it before deployment. Consistent with Section 7 of the Agreement, Pazau is not liable for any Action executed, or Output sent, in accordance with Customer's configuration, including a refund, rebooking, cancellation, account change, or message that Customer's Procedures and Actions permitted. This Section 6.2 does not limit Pazau's responsibility for a failure of the Services to perform in accordance with the Documentation, for example executing an Action that Customer's configuration did not permit or bypassing an Approval Step Customer configured.
6.3 Human review. Customer will implement human oversight proportionate to the risk of each use case. This includes Approval Steps for Actions that are financially material, irreversible, or have legal or similarly significant effects on an individual. Pazau recommends, and the Documentation describes, default Approval Steps for payments, refunds above a Customer-set amount, and changes to identity or contact information.
6.4 Sandbox and testing. On Business and Enterprise plans, Pazau provides a sandbox environment and simulation tools that let Customer test Procedures and Actions against historical or synthetic conversations before promoting them to production. Customer should use them.
6.5 Pazau Guard. Pazau maintains guardrails that operate independently of Customer's Procedures, including PII detection and redaction, prompt-injection and jailbreak detection, topic restrictions, and Action parameter validation. Customer may add guardrails but may not disable Pazau's baseline safety guardrails.
6.6 Kill switch. Customer may pause any AI Feature, Procedure, or Action at any time from the Services. A pause takes effect for new conversations within 60 seconds.
7. Traces
7.1 Generation. The Services generate a Trace for each conversation or task handled by the AI Features.
7.2 Retention. Pazau retains Traces for 18 months by default. On Enterprise plans, Customer may configure Trace retention from 30 days to 7 years. Traces containing Protected Health Information or cardholder data are retained as configured subject to the Business Associate Agreement and Pazau Guard redaction settings.
7.3 Access and export. Customer may view Traces in the Services, export them in JSON through the Traces API, and stream them to Customer's SIEM or data warehouse using the connectors described in the Documentation.
7.4 Post-termination. Customer may export Traces for 30 days after termination or expiration of the Agreement. Pazau then deletes them in accordance with the DPA, within 90 days after termination or expiration.
7.5 Use by Pazau. Pazau accesses Traces only to provide and support the Services, investigate incidents, enforce this AI Addendum, and comply with law, in each case subject to the DPA.
8. Prohibited AI Uses
8.1 Customer will not use, and will not permit any Authorized User or third party to use, the AI Features to:
- (a) deploy subliminal, purposefully manipulative, or deceptive techniques that materially distort a person's behavior by impairing their ability to make an informed decision, causing or reasonably likely to cause significant harm;
- (b) exploit the vulnerabilities of a person or group due to age, disability, or a specific social or economic situation, in a way that materially distorts their behavior and causes or is reasonably likely to cause significant harm;
- (c) evaluate or classify individuals based on social behavior or personal characteristics to produce a social score leading to detrimental or unfavorable treatment;
- (d) assess or predict the risk of a person committing a criminal offense based solely on profiling or personality traits;
- (e) create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage;
- (f) infer the emotions of individuals in the workplace or in education institutions, except for medical or safety reasons;
- (g) categorize individuals based on biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation;
- (h) make decisions based solely on automated processing that produce legal or similarly significant effects on an individual (for example, denying credit, insurance coverage, or medical care) without meaningful human review and a lawful basis under applicable law;
- (i) impersonate a real person, or represent that an Output was produced by a human when it was not;
- (j) generate content that is unlawful, defamatory, or infringing, or that sexualizes minors; or
- (k) attempt to extract model weights, system prompts, or training data, or to circumvent Pazau Guard.
8.2 High-risk systems. Customer will not use the AI Features as, or as a safety component of, a high-risk AI system within the meaning of Annex III of Regulation (EU) 2024/1689 (the "EU AI Act"), including for creditworthiness evaluation, life and health insurance pricing, employment decisions, or access to essential public services, unless the parties have agreed in a signed writing to the allocation of obligations for that use.
8.3 Enforcement. If Pazau reasonably believes Customer is engaged in a Prohibited AI Use, Pazau may suspend the affected AI Feature in accordance with the Agreement, with prior notice where reasonably practicable. Pazau will limit any suspension to the extent necessary and restore access promptly once the issue is resolved.
9. Transparency and the EU AI Act
9.1 Roles. For the purposes of the EU AI Act, Pazau is the provider of the AI Features as an AI system and Customer is the deployer. Where Pazau integrates a general-purpose AI model provided by a Model Provider, that Model Provider is the provider of the general-purpose AI model.
9.2 Disclosure to End Users. Customer will ensure that End Users are informed, in a clear and distinguishable manner at the latest at the time of first interaction, that they are interacting with an AI system, unless this is obvious from the context. Pazau provides default AI disclosure messages for chat, messaging, email, and voice channels (for example, a spoken greeting in Pazau Voice identifying the agent as an AI assistant). These defaults are enabled by default. If Customer modifies or disables them, Customer is responsible for providing an equivalent disclosure.
9.3 Synthetic content. Where the AI Features generate synthetic audio, Pazau marks the Outputs in a machine-readable format where technically feasible, as described in the Documentation.
9.4 Deployer information. Pazau will make available to Customer the information reasonably required for Customer to meet its deployer obligations, including instructions for use, known limitations, the Model Providers used, and a summary of Pazau's evaluation and red-teaming practices.
9.5 Cooperation. Each party will reasonably cooperate with the other in responding to inquiries from a market surveillance authority or other regulator regarding the AI Features.
10. Model Providers and model changes
10.1 Listing. Pazau lists each Model Provider, the AI Features it supports, and its processing locations on the Sub-processors page. The addition or replacement of a Model Provider is subject to the sub-processor notice and objection process in the DPA (30 days' notice and a right to object).
10.2 Regional processing. For Customers whose data is hosted in Pazau's EU region, Pazau uses Model Provider endpoints located in the European Economic Area, except where the Documentation identifies a feature as unavailable in the EU region and Customer elects to enable it.
10.3 Material model changes. Pazau will give Customer at least 30 days' notice before a Material Model Change. A "Material Model Change" is a change of Model Provider, or a change of model family, that Pazau reasonably expects to materially affect the behavior, accuracy, latency, or language coverage of the AI Features. Routine version updates within a model family, security patches, and changes that Pazau reasonably determines do not materially affect Outputs are not Material Model Changes.
10.4 Evaluation and pinning. During the notice period, Pazau will make the new model available in Customer's sandbox so Customer can evaluate its Procedures. If Customer reasonably objects to a Material Model Change, Customer may, where the prior model remains available from the Model Provider, keep its production environment on the prior model for up to 90 days after the change takes effect. If the prior model is not available and the change materially degrades the AI Features for Customer, Customer may terminate the affected Order Form by written notice given within 30 days after the change takes effect, and Pazau will refund any prepaid Fees covering the remainder of the Subscription Term after the effective date of termination, as provided in Section 10.4 of the Agreement.
10.5 Emergency changes. Pazau may make a model change on shorter notice where needed to address a security vulnerability, a legal requirement, or a Model Provider's deprecation or outage. In that case Pazau will notify Customer as soon as reasonably practicable.
11. Accuracy and limitations
11.1 Probabilistic outputs. AI Features use probabilistic models. Outputs may be inaccurate, incomplete, or inappropriate for Customer's purpose, and the same Input may produce different Outputs.
11.2 Disclaimer. Except as expressly stated in the Agreement and this AI Addendum, Pazau does not warrant that Outputs will be accurate, complete, or error-free, or that any particular resolution rate will be achieved. Published resolution rates and benchmarks are illustrative and are not commitments.
11.3 Not professional advice. Outputs are not legal, medical, financial, or other professional advice. Customer is responsible for configuring Procedures that route regulated advice to qualified humans.
11.4 Warranty that survives. Nothing in this Section 11 limits Pazau's warranty in the Agreement that the Services will perform materially in accordance with the Documentation, including that the AI Features will respect Customer's configured Actions, Approval Steps, and guardrails.
12. AI governance
12.1 AI management system. Pazau maintains an AI management system certified to ISO/IEC 42001. Pazau will maintain that certification, or an equivalent successor, for the Subscription Term.
12.2 Evaluation and red-teaming. Before releasing a new AI Feature or a Material Model Change, Pazau conducts pre-release evaluations covering accuracy, harmful content, bias across supported languages, prompt injection, data leakage, and Action safety. Pazau conducts adversarial red-teaming of the AI Features at least annually, including by an independent third party.
12.3 Incident handling. Pazau treats a failure of an AI Feature that results in unauthorized access to or disclosure of Customer Data as a Security Incident under the DPA. Pazau will notify Customer without undue delay of any other AI incident it identifies that has materially affected Customer's Outputs or Actions, such as a guardrail failure, and will provide relevant Traces and a remediation summary.
12.4 Documentation. Pazau publishes a model card for each AI Feature at docs.pazau.com describing its intended use, limitations, languages supported, and evaluation results.
13. Changes to this AI Addendum
13.1 Pazau may update this AI Addendum to reflect changes in law or in the AI Features. Pazau will not update it in a way that reduces the protections in Sections 3, 4, 5, or 7 during Customer's then-current Subscription Term. Pazau will give at least 30 days' notice of any material update, and the updated version applies from Customer's next renewal unless Customer agrees otherwise.
13.2 Questions about this AI Addendum may be sent to legal@pazau.com. Questions about Personal Data may be sent to privacy@pazau.com.